Exploitdb Exploits
31,357 exploits tracked across all sources.
Open Auto Classifieds 1.5.9 - Multiple Vulnerabilities
by Andrew Horton
Moa Gallery < 1.2.0 - Remote Code Execution via MOA_PATH Parameter
Multiple PHP remote file inclusion vulnerabilities in Moa Gallery 1.2.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the MOA_PATH parameter to (1) _error_funcs.php, (2) _integrity_funcs.php, (3) _template_component_admin.php, (4) _template_component_gallery.php, (5) _template_parser.php, (6) mod_gallery_funcs.php, (7) mod_image_funcs.php, (8) mod_tag_funcs.php, (9) mod_tag_view.php, (10) mod_upgrade_funcs.php, (11) mod_user_funcs.php, (12) page_admin.php, (13) page_gallery_add.php, (14) page_gallery_view.php, (15) page_image_add.php, (16) page_image_view_full.php, (17) page_login.php, and (18) page_sitemap.php in sources/.
by cr4wl3r
Moa Gallery <1.2.0 - Path Traversal
Directory traversal vulnerability in sources/_template_parser.php in Moa Gallery 1.2.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the p_filename parameter, a different issue than CVE-2009-4614.
by GoLd_M
Moa Gallery 1.2.0 - 'index.php?action' SQL Injection
by Mr.SQL
JCE-Tech SearchFeed Script - Cross-Site Scripting via Search Parameter
Cross-site scripting (XSS) vulnerability in index.php in JCE-Tech SearchFeed Script allows remote attackers to inject arbitrary web script or HTML via the search parameter.
by Moudi
php_video_script - Cross-Site Scripting via Key Parameter
Cross-site scripting (XSS) vulnerability in index.php in JCE-Tech PHP Video Script allows remote attackers to inject arbitrary web script or HTML via the key parameter.
by Moudi
Crazy Star plugin 2.0 for Discuz! - Authenticated SQL Injection via fmid Parameter
SQL injection vulnerability in plugin.php in the Crazy Star plugin 2.0 for Discuz! allows remote authenticated users to execute arbitrary SQL commands via the fmid parameter in a view action.
by ZhaoHuAn
DigiOz Guestbook 1.7.2 - Cross-Site Scripting via Search Term Parameter
Cross-site scripting (XSS) vulnerability in search.php in DigiOz Guestbook 1.7.2 allows remote attackers to inject arbitrary web script or HTML via the search_term parameter.
by Moudi
JCE-Tech Auction RSS Content Script 3.0 - Cross-Site Scripting via id Parameter
Multiple cross-site scripting (XSS) vulnerabilities in JCE-Tech Auction RSS Content Script 3.0 allow remote attackers to inject arbitrary web script or HTML via the id parameter to (1) rss.php and (2) search.php.
by Moudi
JCE-Tech Auction RSS Content Script 3.0 - Cross-Site Scripting via id Parameter
Multiple cross-site scripting (XSS) vulnerabilities in JCE-Tech Auction RSS Content Script 3.0 allow remote attackers to inject arbitrary web script or HTML via the id parameter to (1) rss.php and (2) search.php.
by Moudi
IBM Tivoli Identity Manager 5.0.5 - User Profile HTML Injection
by IBM
Novell Client for Windows 2000/XP - ActiveX Remote Denial of Service
by Francis Provencher
IBM Lotus Notes Connector - Denial of Service via lnresobject.dll ActiveX Control
A certain ActiveX control in lnresobject.dll 7.1.1.119 in the Research In Motion (RIM) Lotus Notes connector for BlackBerry Desktop Manager 5.0.0.11 allows remote attackers to cause a denial of service (Internet Explorer crash) by referencing the control's CLSID in the classid attribute of an OBJECT element.
by Francis Provencher
Cerberus FTP 3.0.1 - 'ALLO' Remote Overflow Denial of Service (Metasploit)
by Francis Provencher
Turnkey Arcade Script - SQL Injection
SQL injection vulnerability in index.php in Turnkey Arcade Script allows remote attackers to execute arbitrary SQL commands via the id parameter in a browse action, a different vector than CVE-2008-5629.
by Red-D3v1L
Joomla! com_siirler 1.2 RC - SQL Injection
SQL injection vulnerability in the Q-Proje Siirler Bileseni (com_siirler) component 1.2 RC for Joomla! allows remote attackers to execute arbitrary SQL commands via the sid parameter in an sdetay action to index.php.
by v3n0m
EMO Breeder Manager - SQL Injection via video.php idd Parameter
SQL injection vulnerability in video.php in EMO Breeder Manager (aka EMO Breader Manager) allows remote attackers to execute arbitrary SQL commands via the idd parameter.
by Mr.SQL
HyperVM - File Permissions Credential Disclosure
by Xia Shing Zee
Lanai Core 0.6 - Path Traversal via Download Module f Parameter
Directory traversal vulnerability in modules/backup/download.php in Lanai Core 0.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the f parameter.
by Khashayar Fereidani
War-FTPD 1.65 - MKD/CD Requests Denial of Service
by opt!x hacker
Uebimiau Webmail 3.2.0-2.0 - Unauthenticated Exposure of Sensitive Information via Direct Request
Uebimiau Webmail 3.2.0-2.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database with usernames and password hashes via a direct request for system_admin/admin.ucf.
by Septemb0x
Radvision Scopia - Cross-Site Scripting via Page Parameter
Cross-site scripting (XSS) vulnerability in entry/index.jsp in Radvision Scopia 5.7, and possibly other versions before SD 7.0.100, allows remote attackers to inject arbitrary web script or HTML via the page parameter.
by Francesco Bianchino
By Source